Genetic algorithm optimization-based Modbus TCP protocol test case generation method

Abstract

The invention provides a Modbus TCP (Transmission Control Protocol) test case generation method based on genetic algorithm optimization. According to the method, the test effectiveness and efficiency are improved through a finely designed fitness evaluation formula and a self-adaptive variation mechanism. The fitness evaluation formula evaluates the fitness value of the individual from the three aspects of the distance between the individual and the group center test case, the abnormal code of the individual and the edge value coverage rate of the data bit of the individual. A self-adaptive variation rate mechanism is introduced, so that each offspring individual can be varied according to a certain probability on the basis of inheriting excellent characteristics of a parent. The variation mechanism not only retains excellent individuals, but also encourages generation of new excellent individuals, so that diversity of test case populations is effectively increased, and the capacity of discovering unknown errors and abnormities is improved. And the generation process of the fuzzy test case is adjusted by combining the feedback of the tested PLC, so that the test case which is more likely to trigger collapse is screened out.

Description

Technical Field

[0001] The present invention relates to the technical field of fuzzy testing, in particular to a method for generating Modbus TCP protocol test cases based on genetic algorithm optimization. Background Art

[0002] The shore power control system focuses on the precise regulation and management of ground power during ship mooring. In the emerging power system, incorporating the Modbus communication protocol into the network security assessment of edge terminals has become a model practice. With its unique advantages, fuzz testing technology has shown significant results in detecting potential security weaknesses in the Modbus protocol and is an efficient vulnerability mining method.

[0003] The existing solution is: Peach, as an open source and popular network protocol security testing framework, is known for its powerful fuzz testing capabilities. It induces the target software to expose abnormal behavior by generating diverse random and abnormal inputs, and then explores potential security vulnerabilities and program errors. Peach is not only suitable for complex network protocol testing, but also shows a high degree of flexibility and scalability, effectively improving the verification efficiency of software security. However, the current fuzz testing also has its own problems. However, the current fuzz testing has its limitations, mainly manifested in low generation effectiveness, high repetition rate, and low diversity.

[0004] In order to make the individual differences between different types obvious, the fitness evaluation formula evaluates the individual's fitness value from three aspects: the Manhattan distance between the individual and the group center test case, the individual's abnormal code and the edge value coverage of the individual data bit. In order to further increase the diversity of test cases, the concept of adaptive mutation rate is introduced. Mutation occurs with a certain probability according to the adaptive mechanism. This mutation mechanism not only retains the key features of excellent individuals, but also promotes the generation of new excellent individuals, so that the test case population can continue to evolve, which helps to discover more potential anomalies and errors. The test cases constructed by the present invention are all in line with the protocol specification through the designed fitness evaluation formula and adaptive mutation rate mechanism, with low redundancy, high effectiveness, and diversity, which improves the efficiency of Modbus TCP protocol fuzz testing. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a Modbus TCP protocol test case generation method based on genetic algorithm optimization, which solves the problems of low effectiveness, high repetition rate and low diversity generated in the current fuzzy test.

[0006] To solve the above technical problems, the technical solution adopted by the present invention is: a Modbus TCP protocol test case generation method based on genetic algorithm optimization, characterized in that it includes the following steps: S1: Initialize specific values ​​according to different types of exception codes to ensure that each exception code can be uniquely identified; S2: Use Gray code encoding strategy to encode the test cases and construct the initial test case population; S3: Calculate the fitness of each individual and derive the fitness of the entire population based on it to evaluate the quality of the current population; S4: Using the roulette wheel selection method, based on the fitness value of the individual, select the individual with higher fitness from the current population as the parent individual of the next round of crossover operation; S5: From the parent individuals selected in S4, select two individuals as a pair, randomly determine a crossover point, and then follow the preset crossover probability , after the crossover point, part of the chromosomes of the two individuals are exchanged to generate new offspring individuals; S6: Based on the adaptive mutation rate , perform mutation operations on each offspring individual to increase the diversity of the population; S7: Determine whether the iteration termination condition is met; if so, execute S8; otherwise, return to S3 to continue the next round of iteration; S8: When the iteration is terminated, the test case population finally obtained is decoded, restored to the original test case format, and sent to the slave device through the Socket communication protocol; S9: Receive the data packet returned by the slave device, parse the data packet content to obtain the exception code information, which is used to verify the validity and accuracy of the test case.

[0007] Preferably, in step S1, exception code 3, exception code 2, and exception code 1 are assigned values ​​respectively. , , ; If the generated test case responds normally, it means that the generated test case belongs to a normal data packet, then the assignment value of this test case is the smallest, recorded as ; The exception code is assigned < < < .

[0008] Preferably, step S3 comprises the following steps: S301: The initial population consists of Modbus TCP protocol data packets captured during normal communication between the host computer and the PLC; S302: Calculate the average test case of all test cases in the group , and then calculate the individual With average use case The Manhattan distance between each data bit is calculated by adding up the distances calculated separately to calculate the individual With average use case Add 1 to the distance between them and take the reciprocal; the formula is as follows: ; ; ; in Represents an individual With average use case The Manhattan distance between A collection of bytes representing individual data bits; represents the set of data bits of the central test case; m represents the total number of data bits; S303: Calculate individual Whether the data bits are within the edge value range, the data bits within the range divided by the total number of data bits is the edge value coverage rate. The formula is as follows: ; in Represents an individual The edge value coverage of , U represents the range of interesting values , m is the total number of data bits; S304: Calculate the fitness of individuals. With individuals Add them together and multiply them by the abnormal code value as the individual's fitness. The formula is as follows: ; in Represents an individual The fitness value of , , , , , Represents an individual Edge value coverage, Represents an individual With average use case The Manhattan distance between S305: Calculate the fitness of the group. According to the calculated fitness of each individual, find the average as the fitness of the group. The formula is as follows: ; in Represents the fitness value of the population, and M represents the total number of individuals in the population.

[0009] Preferably, the step S4 includes the following steps: S401: According to the response code feedback from the slave station, select individuals with normal individuals and different types of abnormal codes to ensure the diversity of the population; S402: According to the fitness value of each individual calculated in step S3, calculate the probability of each individual in the population being inherited , and the calculation formula is as follows: ; Where M represents the total number of individuals in the population; S403: Calculate the cumulative probability of each individual in the population , and the calculation formula is as follows: ; S404: Randomly generate a rational number rand in [0, 1]. If rand < L(1), then select the first individual, assign and select the i-th individual that satisfies L(i - 1) < rand < L(i), and the selected individuals enter the offspring population for the next operation.

[0010] Preferably, in the step S5, the crossover probability The calculation formula is as follows: ; Where Represents the maximum value of the fitness of all individuals in the population; Represents the fitness value of the population; Represents the maximum value of the fitness values of two individuals to be crossed; And Are preset values.

[0011] Preferably, in the step S6, if the fitness of the individual Is lower than the fitness of the population, increase the mutation probability to promote mutation, otherwise reduce the mutation rate of the individual; the calculation formula of the adaptive mutation probability is as follows: ; Where Represents the maximum value of the fitness of all individuals in the population; Represents the fitness value of the population; Represents the fitness value of the individual to be mutated; And Are preset values.

[0012] Preferably, in step S7, the condition is composed of whether the maximum number of iterations and the group fitness have reached a preset value; the iteration termination condition is as follows: ; in represents the fitness of the population, Represents the number of iterations; and The preset value.

[0013] The present invention provides a Modbus TCP protocol test case generation method based on genetic algorithm optimization, which adopts genetic algorithm to optimize the test case generation process of Modbus TCP protocol, and solves the problems of high redundancy, low test efficiency and insufficient effectiveness that are common in traditional fuzzy testing methods. Through the designed fitness evaluation formula, the fitness value of each test case is comprehensively evaluated from three aspects: abnormal code assignment, Manhattan distance between individual and group center cases, and individual edge value coverage. This fitness formula not only ensures the pertinence and effectiveness of the test case, but also greatly improves the comprehensiveness of the test.

[0014] In order to further increase the diversity of test cases and the ability to explore errors, the present invention introduces the concept of adaptive mutation rate. In the evolution process of the genetic algorithm, each offspring individual can mutate with a certain probability according to the adaptive mechanism on the basis of inheriting the excellent characteristics of the parent generation. This mutation mechanism not only retains the key features of excellent individuals, but also promotes the generation of new excellent individuals, so that the test case population can continue to evolve, which helps to discover more potential anomalies and errors. The test cases constructed by the present invention are all in line with the protocol specification through the designed fitness evaluation formula and adaptive mutation rate mechanism, with low redundancy, high effectiveness, and diversity, which improves the efficiency of Modbus TCP protocol fuzzy testing. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The present invention will be further described below in conjunction with the accompanying drawings and embodiments: Figure 1 It is a module diagram of a test case generation system for the Modbus TCP protocol provided by the present invention; Figure 2 It is a flow chart of a test case generation method for the Modbus TCP protocol provided by the present invention; Figure 3 is a fitness flow chart provided by the present invention; Figure 4 It is a flow chart of the adaptive rate provided by the present invention. DETAILED DESCRIPTION

[0016] The present invention designs a Modbus TCP protocol test case generation method architecture based on genetic algorithm optimization, which is implemented in Python. The module diagram is as follows: Figure 1 As shown. This architecture integrates multiple key modules, including test case encoding, message interaction, protocol analysis, fitness evaluation, selection, crossover, mutation, and decoding. The encoding module is responsible for the construction of the initial test cases, which are then transmitted to the PLC under test through the message interaction module. The response of the PLC is received and sent to the protocol parsing module to distinguish normal responses from various abnormal situations. The fitness module calculates the fitness value of each test case based on the parsing results, and these values ​​guide subsequent operations. The selection module selects excellent individuals, and the crossover module selects excellent individuals based on the crossover probability. Promote gene exchange between test cases, and the mutation module introduces adaptive mutation rate To increase diversity. After this series of operations, the decoding module converts the mutated test cases back to the Modbus TCP protocol message format. The system continues to iterate this process, continuously generating and optimizing test cases until the preset termination condition is met. If the condition is met, the debugging is terminated, and the PLC is subjected to in-depth fuzz testing using the final generated protocol message. If not, the process returns to the cross module to continue iterating until the goal is achieved, ensuring the comprehensiveness and efficiency of the test.

[0017] like Figure 2 As shown, the present invention proposes a Modbus TCP protocol test case generation method based on genetic algorithm optimization, the method comprising the following steps: S1: In the Modbus TCP protocol, the exception code of the protocol represents different meanings, and different exception codes are assigned values ​​according to the status of Modbus transaction processing. The longer the processing time, the easier it is for the PLC under test to trigger an exception. Therefore, the present invention assigns different values ​​to different exception codes in the protocol parsing module of the method according to the length of Modbus transaction processing; In this implementation method, exception code 3, exception code 2, and exception code 1 are assigned values ​​respectively. , , If the generated test case responds normally, it means that the generated test case belongs to a normal data packet, then the value assigned to this test case is the smallest, recorded as ; The assignment of exception codes is as follows: < < < ; in =1, =3, =9, =12, according to the test results of different PLCs, Adjust the value of ; S2: Use Gray code encoding strategy to encode the test cases and construct the initial test case population; S3: Figure 3 As shown, the fitness of each individual is calculated, and the fitness of the entire population is obtained based on this to evaluate the quality of the current population. This step includes the following sub-steps: S301: The initial population consists of Modbus TCP protocol data packets captured during normal communication between the host computer and the PLC; S302: Calculate the average test case of all test cases in the group , and then calculate the individual With average use case The Manhattan distance between each data bit is calculated by adding up the distances calculated separately to calculate the individual With average use case Add 1 to the distance between them and take the reciprocal. The formula is as follows: ; ; ; in Represents an individual With average use case The Manhattan distance between A collection of bytes representing individual data bits; represents the set of data bits of the central test case; m represents the total number of data bits; S303: Calculate individual Whether the data bits are within the edge value range, the data bits within the range divided by the total number of data bits is the edge value coverage rate. The formula is as follows: ; in Represents an individual The edge value coverage of , U represents the range of interesting values , m is the total number of data bits; =0, =6, =249, =256, according to the test results of different PLCs, The value of is adjusted.

[0018] S304: Calculate the fitness of individuals. With individuals Add them up and multiply by the exception code assignment as the fitness of the individual. The formula is as follows: ; Among them represents the fitness value of the individual , , , , , , represents the edge value coverage rate of the individual , represents the Manhattan distance between the individual and the average test case ; S305: Calculate the population fitness. Based on the calculated fitness of each individual, calculate the average as the population fitness. The formula is as follows: ; Among them represents the fitness value of the population, and M represents the total number of individuals in the population; S4: Use the roulette wheel selection method. Based on the fitness value of the individual, select the individuals with higher fitness from the current population as the parent individuals for the next crossover operation, which includes the following sub-steps: S401: According to the response code feedback from the slave station, screen out the individuals with normal individuals and different types of exception codes to ensure the diversity of the population; S402: According to the fitness value of each individual calculated in step S3, calculate the inheritance probability of each individual in the population , and the calculation formula is as follows: ; Among them, M represents the total number of individuals in the population; S403: Calculate the cumulative probability of each individual in the population , and the calculation formula is as follows: ; S404: Randomly generate a rational number rand in [0, 1]. If rand < L(1), then select the first individual. Assign to select the i-th individual that satisfies L(i - 1) < rand < L(i), and the selected individual enters the offspring population for the next operation.

[0019] S5: From the parent individuals selected in S4, select two individuals in sequence as a pair, randomly determine a crossover point, and then according to the preset crossover probability , exchange part of the chromosomes of the two individuals after the crossover point to generate new offspring individuals.

[0020] ; in Represents the maximum fitness of all individuals in the population; Represents the fitness value of the population; Represents the maximum fitness value of two individuals to be crossed; and is a preset value. =0.2, =0.8, according to the test results of different PLCs, The value of is adjusted.

[0021] S6: Figure 4 As shown, according to the adaptive mutation rate , perform mutation operations on each offspring individual to increase the diversity of the population.

[0022] ; in Represents the maximum fitness of all individuals in the population; Represents the fitness value of the population; Indicates the fitness value of the individual to be mutated; and is a preset value. =0.1, =0.0005, according to the test results of different PLCs, The value of is adjusted.

[0023] S7: Determine whether the iteration termination condition is met. If so, execute S8; otherwise, return to S3 to continue the next round of iteration.

[0024] ; in represents the fitness of the population, Represents the number of iterations; and is a preset value. =4.8, =100, according to the test results of different PLCs, The value of is adjusted.

[0025] S8: When the iteration is terminated, the final test case population is decoded, restored to the original test case format, and sent to the slave device through the Socket communication protocol.

[0026] S9: Receive the data packet returned by the slave device, parse the data packet content to obtain the exception code information, which is used to verify the validity and accuracy of the test case.

[0027] In solving the common problems of high redundancy and non-standard test case protocols in the Modbus TCP protocol fuzzy testing process, the present invention proposes a Modbus TCP protocol test case generation method based on genetic algorithm optimization. This method improves the effectiveness and efficiency of the test through a carefully designed fitness evaluation formula and an adaptive mutation mechanism. The fitness evaluation formula evaluates the fitness value of an individual from three aspects: the distance between the individual and the group center test case, the individual's abnormal code, and the edge value coverage of the individual data bit. The adaptive mutation rate mechanism is introduced so that each offspring individual can mutate according to a certain probability on the basis of inheriting the excellent characteristics of the parent generation. This mutation mechanism not only retains excellent individuals, but also encourages the generation of new excellent individuals, thereby effectively increasing the diversity of the test case population and improving the ability to discover unknown errors and anomalies. The generation process of the fuzzy test case is adjusted in combination with the feedback of the PLC under test, so as to screen out test cases that are more likely to trigger a crash.

[0028] The above embodiments are only preferred technical solutions of the present invention and should not be regarded as limiting the present invention. The protection scope of the present invention shall be the technical solutions recorded in the claims, including equivalent replacement solutions of the technical features in the technical solutions recorded in the claims. That is, equivalent replacement improvements within this scope are also within the protection scope of the present invention.

Claims

1. A Modbus TCP protocol test case generation method based on genetic algorithm optimization, characterized in that: It includes the following steps: S1: Initialize specific values according to different types of error codes to ensure that each error code can be uniquely identified; S2: Encode the test cases using the Gray code encoding strategy to construct the initial test case population; S3: Calculate the fitness of each individual and thus obtain the fitness of the entire population to evaluate the quality of the current population; S4: Use the roulette wheel selection method to select individuals with higher fitness from the current population as the parent individuals for the next round of crossover operation based on the fitness values of the individuals; S5: From the parent individuals selected in S4, select two individuals as a pair, randomly determine a crossover point, and then follow the preset crossover probability , after the crossover point, part of the chromosomes of the two individuals are exchanged to generate new offspring individuals; S6: Based on the adaptive mutation rate , perform mutation operations on each offspring individual to increase the diversity of the population; S7: Determine whether the iteration termination condition is met; if it is met, execute S8; Otherwise, return to S3 to continue the next round of iteration; S8: After the iteration terminates, decode the finally obtained test case population, restore it to the original test case format, and send it to the slave device through the Socket communication protocol; S9: Receive the data packet returned by the slave device, parse the content of the data packet to obtain the error code information for verifying the effectiveness and accuracy of the test cases.

2. According to a Modbus TCP protocol test case generation method based on genetic algorithm optimization as described in claim 1, it is characterized in that, In step S1, exception code 3, exception code 2, and exception code 1 are assigned values ​​respectively. , , ; If the generated test case responds normally, it means that the generated test case belongs to a normal data packet, then the assignment value of this test case is the smallest, recorded as ; The exception code is assigned < < < .

3. According to a Modbus TCP protocol test case generation method based on genetic algorithm optimization as described in claim 1, it is characterized in that, The step S3 includes the following steps: S301: The initial population consists of Modbus TCP protocol data packets captured when the master computer communicates with the PLC normally; S302: Calculate the average test case of all test cases in the group , and then calculate the individual With average use case The Manhattan distance between each data bit is calculated by adding up the distances calculated separately to calculate the individual With average use case Add 1 to the distance between them and take the reciprocal; the formula is as follows: ； ； ； in Represents an individual With average use case The Manhattan distance between A collection of bytes representing individual data bits; represents the set of data bits of the central test case; m represents the total number of data bits; S303: Calculate individual Whether the data bits are within the edge value range, the data bits within the range divided by the total number of data bits is the edge value coverage rate. The formula is as follows: ； in Represents an individual The edge value coverage of , U represents the range of interesting values , m is the total number of data bits; S304: Calculate the fitness of individuals. With individuals Add them together and multiply them by the abnormal code value as the individual's fitness. The formula is as follows: ； in Represents an individual The fitness value of , , , , , Represents an individual Edge value coverage, Represents an individual With average use case The Manhattan distance between S305: Calculate the population fitness. Based on the calculated fitness of each individual, calculate the average as the population fitness. The formula is as follows: ； in represents the fitness value of the population, and M represents the total number of individuals in the population.

4. A Modbus TCP protocol test case generation method based on genetic algorithm optimization according to claim 1, characterized in that, The step S4 includes the following steps: S401: According to the response code feedback from the slave station, select individuals with normal individuals and different types of error codes to ensure the diversity of the population; S402: Calculate the probability of each individual in the population being inherited based on the fitness value of each individual calculated in step S3 , the calculation formula is as follows: ； where M represents the total number of individuals in the population; S403: Calculate the cumulative probability of each individual in the population , the calculation formula is as follows: ； S404: Randomly generate a rational number rand in [0, 1]. If rand < L(1), select the first individual. Assign and select the i-th individual that satisfies L(i - 1) < rand < L(i). The selected individuals enter the offspring population for the next operation.

5. A Modbus TCP protocol test case generation method based on genetic algorithm optimization according to claim 1, characterized in that, In step S5, the crossover probability The calculation formula is as follows: ； in Represents the maximum fitness of all individuals in the population; Represents the fitness value of the population; Represents the maximum fitness value of two individuals to be crossed; and The preset value.

6. A Modbus TCP protocol test case generation method based on genetic algorithm optimization according to claim 1, characterized in that: In step S6, if the individual If the fitness of is lower than the fitness of the population, the mutation probability is increased to promote mutation, otherwise the mutation rate of the individual is reduced; the calculation formula for the adaptive mutation probability is as follows: ； in Represents the maximum fitness of all individuals in the population; Represents the fitness value of the population; Indicates the fitness value of the individual to be mutated; and The preset value.

7. A Modbus TCP protocol test case generation method based on genetic algorithm optimization according to claim 1, characterized in that: In the step S7, the condition consists of the maximum number of iterations and whether the population fitness reaches a preset value; the iteration termination conditions are as follows: ； in represents the fitness of the population, Represents the number of iterations; and The preset value.

Images